Lessons

Because Spring Security aims to work standalone, you don't need to place any special configuration files in the Java runtime.

InterfacePasswordEncoder from Spring Security is used to perform one-way password conversion to ensure that it is stored securely.

Spring provides comprehensive support for protection against cross-site request forgery (CSRF)

This section discusses the high-level architecture of Spring Security in servlet-based applications

Remember-me or persistent-login authentication refers to websites that can remember a user's identity between sessions. This is typically achieved by sending a cookie to the browser, with the cookie being detected during subsequent sessions and resulting in automatic login.

OpenID 1.0 and 2.0 protocols are deprecated and users are advised to migrate to OpenID Connect which is supported by spring-security-oauth2

Examples include X.509, Siteminder, and authentication by the Java EE container in which the application runs.

Spring Security provides a package that can delegate authentication requests to the Java Authentication and Authorization Service (JAAS). This package is detailed below

The most common use of X.509 certificate authentication is to authenticate a server using the SSL protocol, most commonly when using HTTPS from a browser. The browser automatically verifies that the certificate presented by the server was issued (that is, digitally signed) by one of the trusted certificate authorities specified in the list it maintains.

Spring Boot 2.x provides the ability to fully use auto-configuration to configure login via OAuth 2.0.

HttpSecurity .oauth2Login() provides a number of configuration options for setting up OAuth 2.0 authorization. The main configuration options are grouped by their protocol endpoint counterparts.